CVE-2025-39868 Overview
CVE-2025-39868 is a Linux kernel vulnerability in the erofs (Enhanced Read-Only File System) subsystem. The flaw triggers a runtime warning in truncate_folio_batch_exceptionals() at mm/truncate.c:89 during filesystem unmount operations. The warning was introduced by commit 0e2f80afcfa6 to ensure that all Direct Access (DAX) pages are idle before filesystem unmount. That fix was applied to xfs and ext4 but missed erofs, causing the WARN_ON_ONCE to fire when unmounting erofs volumes.
Critical Impact
A local low-privileged user can trigger kernel warnings during erofs unmount, potentially impacting kernel integrity and system availability on affected 6.17-rc kernels.
Affected Products
- Linux Kernel 6.17-rc1
- Linux Kernel 6.17-rc2 through 6.17-rc5
- Linux distributions shipping erofs support with affected kernel versions
Discovery Timeline
- 2025-09-23 - CVE-2025-39868 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-39868
Vulnerability Analysis
The vulnerability resides in the erofs filesystem shutdown path within the Linux kernel. Commit 0e2f80afcfa6 ("fs/dax: ensure all pages are idle prior to filesystem unmount") introduced a WARN_ON_ONCE check in truncate_folio_batch_exceptionals() to verify that filesystems remove all DAX entries prior to unmount. The commit applied the required cleanup fix to xfs and ext4 but omitted the equivalent change in erofs.
When a user unmounts an erofs volume, the kernel path traverses erofs_kill_sb() → generic_shutdown_super() → evict_inodes() → truncate_inode_pages_final() → truncate_folio_batch_exceptionals(). Because erofs did not clear DAX entries prior to teardown, the warning fires at mm/truncate.c:89. This is categorized as a kernel filesystem vulnerability affecting integrity and availability of kernel state.
Root Cause
The root cause is a missing fix in the erofs filesystem code. The DAX page-idle enforcement introduced by commit 0e2f80afcfa6 was not applied to erofs, leaving residual DAX entries during unmount. The subsequent WARN_ON_ONCE in truncate_folio_batch_exceptionals() detects this inconsistency and emits a kernel warning with a full stack trace.
Attack Vector
Exploitation requires local access with low privileges and no user interaction. An authenticated user with permission to mount and unmount erofs volumes can consistently trigger the warning by mounting an erofs image and issuing an umount call. The warning is emitted from process context during syscall exit (__cleanup_mnt → task_work_run → exit_to_user_mode_loop).
The vulnerability is described in prose only because no exploit code has been published. See the upstream commits 181993bb0d626cf88cc803f4356ce5c5abe86278 and 91c34cd6ca1bc67ccf2d104834956af56b5893de on kernel.org for the technical resolution.
Detection Methods for CVE-2025-39868
Indicators of Compromise
- Kernel log entries containing WARNING: CPU: X PID: Y at mm/truncate.c:89 truncate_folio_batch_exceptionals
- Stack traces referencing erofs_kill_sb+0x81/0x90 [erofs] during unmount operations
- Tainted kernel flags appearing after erofs volumes are unmounted on kernel 6.17-rc builds
Detection Strategies
- Monitor dmesg and /var/log/kern.log for the truncate_folio_batch_exceptionals warning signature on hosts running the erofs module
- Correlate umount syscall invocations with subsequent kernel warnings to identify affected systems
- Inventory running kernel versions across the fleet and flag any host executing Linux 6.17-rc1 through 6.17-rc5 with the erofs module loaded
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform for cross-fleet anomaly analysis
- Alert on repeated WARN_ON events involving the erofs subsystem, which may indicate ongoing exposure
- Track lsmod output for erofs presence on production hosts to prioritize patching
How to Mitigate CVE-2025-39868
Immediate Actions Required
- Update the Linux kernel to a release that includes commits 181993bb0d626cf88cc803f4356ce5c5abe86278 and 91c34cd6ca1bc67ccf2d104834956af56b5893de
- Restrict mount and unmount privileges for erofs volumes to trusted administrators only
- Audit systems running 6.17-rc kernels and prioritize their upgrade to a stable release
Patch Information
The upstream fix applies the missed DAX cleanup to the erofs filesystem. Refer to the Linux kernel stable commit 181993bb and the Linux kernel stable commit 91c34cd6 for the authoritative patches. Distribution vendors typically ship these in updated kernel packages; apply vendor updates through standard package management.
Workarounds
- Avoid mounting erofs filesystems with DAX enabled on affected kernel builds
- Unload the erofs module on systems where it is not required using modprobe -r erofs
- Downgrade to a stable Linux kernel release that predates the introduction of the WARN_ON_ONCE in truncate_folio_batch_exceptionals() when patching is not immediately feasible
# Verify kernel version and erofs module status
uname -r
lsmod | grep erofs
# Remove erofs module if not required
sudo modprobe -r erofs
# Apply distribution kernel update
sudo apt update && sudo apt upgrade linux-image-generic
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
